PEAP second phase question

[arturo.reyna]

Hi everybody:

I want to use PEAP in my wireless network; I understand that I need a digital certificate to my server that is in a CS ACS 3.2 with radius for the first phase and establish teh secure tunnel.

My question is, can I use the same CS ACS to authenticate the second phase, I mean I don´t want to define an external database and I want to use users and passwords I have configured in my radius server (the same).

I will really apreciate you help.

Thank you.

[dixho]

Yes. I test it in the lab. I create a user in ACS. I configure the Microsoft supplicant provided by XP SP2 not to check "Automatically use my Winows logon name and password (and domain if any)". When my XP laptop tries to associate to the AP, a username and password is prompted. I enter the user name and password defined in the ACS user database. My XP associate to the AP.

[arturo.reyna]

If I use a windows 2K I think I have to use a ACU cisco client.

what type of eap authentication was the one you use in second phase, leap?

Thank you.

[dixho]

You can use PEAP-GTC or MS' PEAP-MS CHAP V2